+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: ░▒▓[TUTORIAL]►_SHELL & DEFACE WORDPRESS WEBSITES THROUGH SYMLINK SHELL_[/SCREENSHOTS] (/showthread.php?tid=2667946)
░▒▓[TUTORIAL]►_SHELL & DEFACE WORDPRESS WEBSITES THROUGH SYMLINK SHELL_[/SCREENSHOTS] - ｍＯｂｉＩｅ - Jul 11, 2012
[img]http://www.blog-satz.org/wp-content/uploads/wp.gif[/img]
[img]http://sourceblogger.com/wp-content/uploads/2010/11/wordpress-hacked.png[/img]
[img]http://sourceblogger.com/wp-content/uploads/2010/11/wordpress-hacked.png[/img]
Wordpress websites are a bitch to hack through SQLi because it's almost impossible to decrypt the salted hash.
$hash_type$salt$password
PHP Code
<?php
$P$Bp.ZDNMM98mGNxCtHSkc1DqdRPXeoR
But through symlinking it's fairly easy to obtain the administration login/password and upload your shell and deface the website.
In this easy tutorial I will show you JUST how to do that. 🎉
Tutorial:
After you've hacked ANY targeted website (don't have to be a Wordpress website) and uploaded your Shell/Backdoor, upload your Symlink Shell and open it.
Next Click on [Domains & Script] Locate a Wordpress website in the list and click Script:
[img]http://img542.imageshack.us/img542/4051/94409893.jpg[/img]
Within the MySQL Database you will find "DB_USER"and "DB_PASSWORD"
[img]http://img189.imageshack.us/img189/503/34280473.jpg[/img]
The username might be something like "name_wp" just take out the "_wp" when you enter the username in the Administration Panel
[img]http://img801.imageshack.us/img801/5568/61995069.jpg[/img]
PHP Code
<?php
www.site.com/wp-admin.php
☀__∩┐(◣_◢)┌∩__☀
Shell Tutorial:
Sweet! ..were in!! Now let's upload our Shell/Backdoor to Wordpress. 🎉
First your gonna need a "Wordpress Theme" to add your shell to, and you can find some here:
www.freewordpressthemes4u.com
After downloading any theme. It will be in a .rar/.zip format. Just open it and paste your .php shell code in the theme. ( You can simply drag & drop the shell in the theme when it is open in the win rar ).
Once in the Wordpress Dashboard, click the "Appearance" tab.
[img]http://img152.imageshack.us/img152/7297/18353871.jpg[/img]
Next click "Themes" then "Install Themes":
[img]http://img820.imageshack.us/img820/4983/86126745.jpg[/img]
Now Click "Upload" and upload the theme that your shell is in.
[img]http://img809.imageshack.us/img809/157/56849522.jpg[/img]
Shell Link Access:
PHP Code
<?php
www.site.com/wp-content/themes/themename/shellname.php
PHP Code
<?php
www.site.com/blog/wp-content/themes/themename/shellname.php
After you access your shell, just find the "Index.php" and deface the site or store more shells, whatever ..lol
[img]http://img406.imageshack.us/img406/5206/53984724.jpg[/img]
That's it! I know pretty simple yeah? ..lol BTW If you dont have a Symlink Shell you can find one here.
Spoiler (Click to View)
Enjoy and thanks for viewing my thread. 🤝